- [Narrator] Security roles and responsibilities
may differ between organizations,
but there are several common themes
that exist across almost all businesses.
The senior information security leader
in an organization is commonly known
as the chief information security officer, or CISO.
This title is also sometimes pronounced CISO.
In some organizations, the CISO may have a different title,
such as director of information security
or chief security officer.
Another difference between organizations
lies in where the CISO reports.
In some cases, the CISO reports
to the chief information officer, the CIO,
an organization's most senior IT leader.
In other cases the CISO reports
to a risk management or audit function,
providing a degree of separation
between individual responsible for IT
and the individual responsible for ensuring
that IT has effective security controls.
The CISO normally leads a team
of information security professionals.
The size of that team will vary
depending upon the size of the organization,
the nature of the business,
and the specific responsibilities assigned
to information security as opposed
to other technology units.
This may include security generalists
with a broad background across
all the domains of information security,
and/or specialists who focus on particular areas,
such as instant response, network security,
and security awareness.
All of the members of an information security team
must follow important guiding principles for their role.
One of these is the principle of due care.
Due care says that security professionals
must fulfill the legal responsibilities of the organization
as well as the professional standards
of information security.
They must exercise the reasonable level
of care that would be expected
of any security professional in their situation.
The second principle is that of due diligence,
which says that security professionals
should take reasonable measures
to investigate the risks associated with the situation.
For example, if the organization is considering
implementing a major new
customer relationship management system,
security professionals should use due diligence
and investigate the security controls
available with that system to ensure
that they meet the organization's security objectives.